CVE-2026-41213

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.

Affected

node-oauth · node-oauth2-server

CVSS v3.1 GITHUB

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2026-04-23

Updated

2026-04-25

Proof-of-concept exploits (1)

• advisories/GHSA-jhm7-29pj-4xvf

Security advisories

• node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf

References

• CVE Record
• NVD entry